rispost

Configure rights Connections parts with wsadmin

June 12th, 2009

Below a script you can use to set the rights for every part of Connections correctly.

Handy to fix the rights after you have done an upgrade.

FILE ConfigureRightsActivities.py
 appName = ‘Activities’
 lcsearchadmin=’LCdev admin’
 lcadmin=’LCdev admin’

 AdminApp.edit(appName, ‘[ -MapRolesToUsers [ ["person" no yes "" ""] ["everyone" yes no "" ""] ["reader" no
 yes "" ""] ["search-admin" no no "'+lcsearchadmin+'" ""]  ["widget-admin" no no "'+lcadmin+'" "" ] ] ]’)
 print “done…. Configuring rights Activities EAR”
 AdminConfig.save()
!FILE

Run it as follow.

./wsadmin.sh -lang jython -port 8880 -username wasadmin -password udontneedtoknowthispunk -f ./wsadmin_scripts/configureRightsActivities.py

To do it for the other parts just change the appName var, be aware
that the roles between all the Connections parts differ. The Homepage
part for example doesn’t has the search-admin role.

rispost

Lotus Connections 2.0.1 Fix Pack 1 ( 2.0.1.1)

June 10th, 2009

Lotus Connections 2.0.1 Fix Pack 1 ( 2.0.1.1) has been released.

Check this URL for how to apply this one, and what ifixes are included in this big one ( 230 MB ).

Be aware that there are some additional steps besides installing the Fix Pack itself.

http://www-01.ibm.com/support/docview.wss?rs=3265&context=SSYGQH&dc=DB560&dc=DB520&uid=swg21386185&loc=en_US&cs=UTF-8&lang=en&rss=ct3265lotus

Also note that there is a new LotusConnectionsUpdateInstaller -> link. Don’t
know if you have to use this updateinstaller for this Fix Pack already or that
this one has been released for the ifixes after FIx Pack 1 for 2.0.1.

Currently there are already four new ifixes for the 2.0.1.1 version. Can’t give
any practical tips yet, cause I didn’t saw a change to apply this one.

rispost

SSL certificates WebSphere and their expiration dates

June 9th, 2009

When installing Lotus Connections one of the tasks is to make a secure trust
between the WebSphere server and the IHS server. To do this you have to
configure SSL in such a way that the signer of the SSL certificate of the
WebSphere server is known by the IHS server.

You have to export the signer of the SSL cert of the WebSphere server and
then import this into the plugin-key.kdb file of the IHS server (WASplugin).

The SSL signer of the WebSphere server is standard valid for one year, after
the SSL cert experies the SSL connection will break. In case when using
Connections if this happens you will see a 500 error instead or your
Connections pages.

To prevent this you can monitor the expiration date of the SSL cert of the
WebSphere server. To do this login to the WAS admin console of the
Connection server.

  Goto : SSL certificate and key management -> Manage certificate expiration

Disable these two options standing below, my experience is that this isn’t workiing
that good, and maybe I just want to control everything myself :-)

  Automatically replace expiring self-signed certificates
  Delete expiring certificates and signers after replacement

Then goto

  SSL certificate and key management > Manage certificate expiration > Notifications > MessageLog

Check

  Message-log
  E-mail sent to notification list

Configure a mail address to sent the notification to and a SMTP server to use.

If this all is configured you will receive a mail every number of days that you have
configured in Expiration notification threshold attribute on the previous page.

For this to take effect you don’t have to restart the WebSphere server.

If it is time to renew you WebSphere cert you could do it this way.

Shutdown the WebSphere server

Startup the ikeyman utility on the WebSphere server
/opt/IBM/WebSphere/AppServer/bin # ./ikeyman.sh

Open the key.p12 SSL file remove the one with the label of default under Personal
certificates, and create an new Self Signed Certificate with the same label of default.

Then choose the Extract certificate button, and save it as an ARM file. Then you can
choose to import it into the trust.p12 yourself or let WebSphere take care of this.
When you start WebSphere it will automaticaly see that the cert in
the key.p12 is not in the Signer Certificates list of the trust.p12 file and will add it self.

As a last step you have to import the exported ARM file into the Signer Certificates
list of the plugin-key.kdb SSL kdb file. Just grep your ikeyman and get it done, do
a restart of the IHS server for the changes to take affect directly and you are save again.

ps. Currently doing some work with Sametime Gateway 8.0.2 and the Hotfix 1 for OCS
integration. Sametime Gateway then requires WAS fixpack 6.1.0.23, looks like they
changed the expiration dates from one year to fifteen years.

More info

IBM WebSphere Developer Technical Journal: SSL, certificate, and key management enhancements for even stronger security in WebSphere Application Server V6.1

rispost

Finally back online

May 23rd, 2009

After three weeks of down-time my website finally is back on the net.

My ISP (Telfort) messed something up therefor I lost my internet connection.
Because I host my server @home my website also was unreachable for
three weeks.

As an extra suprise my IP was changed so I also had to change my DNS
entries, something I found out after a few days.

But eh were back now :-)

rispost

LDAP benchmark tools

April 9th, 2009

Currently I’m busy setting up Connections for a customer who is
active across the whole world.

Connections has to be set-up to use all LDAP domain servers in use, one
located in the North-America region, one located in the Asian Pacific
region and one located in Europe.

To give myself some more info about the request times looking
up users takes, I found these handy LDAP benchmark tools.

They will show you the time taken to lookup users in the LDAP.
Good info to know to see how much time it takes to lookup users located
in the LDAP domain server that’s located on the other end of the world.

This is one with a GUI, simple to use, not to advanced

http://www.novell.com/coolsolutions/tools/14046.html

Command line one, not simple in its usage, and for my taste to advanced :-) .

http://www.mindcraft.com/directorymark/

Be sure to set these attributes in the directorymark config file

!FILE CONFIG.CON2
 SERVERNAME:10.19.20.100
 SERVERPORT:389
 CLIENTBASESCRIPTS:client1.script
 BINDDN:CN=WebSphereLCbind,CN=Users,DC=globalcorp,DC=net
 BINDPW:doyouneedtoknowthis
 STATDIR:Results\                          #  Be sure this dir exists.

 #For the first time running and to test if everything works out
 #I would suggest to change the following attribute as follows

 MAXRUNTIME:-1
 NUMCLIENTS:1
 THREADSPERCLIENT:1

 # and enable these two attributes to get as much detailed results as possible
 DEBUG:1
 VERBOSE: 1
!FILE

FILE client1.script
 bind_as_root
 ldap_search
 dc=ap,DC=globalcorp,DC=net
 LDAP_SCOPE_SUBTREE
 (&(sAMAccountName=dillm)(objectclass=user))
 ALL
 0
!FILE

Then running the directorymark.exe will give you a output similiar like below

C:\DirectoryMark1.3-Bin-Win2k>DirectoryMark.exe config.conf2

Running Script client1.script0
bind as root: ‘CN=WebSphereLCbind,CN=Users,DC=globalcorp,DC=net’, password ‘doyouneedtoknowit’
t00: ldap_search_st returned 0×00, time:     2 ms, numentries:  1, args: 3301328
, dc=ap,DC=leaseplancorp,DC=net, 2, (&(sAMAccountName=dillm)(objectclass=user)),
 NULL, 1
Thread 0, Done with transactions
thread 0 complete
all threads complete
all children completed

rispost

Yaah errors in Lotus Notes …..

March 20th, 2009

Very detailed….

rispost

Potential risk when using Web based applications on WebSphere Application Server (PK81387)

March 20th, 2009

Flash alert for WebSphere Application Server concerning a security risk.

And then why post it here :-) , Lotus Connections runs on WAS 6.1.0.13
and thus is vulnerably.

Check out the fix here.

Problem Description:
Customers who have Web based applications, including Web services applications running on WebSphere Application Server, have the risk of an attacker having the ability to display application specific files contained within the war file. In addition, there is a potential risk for customers who are using the WebSphere administrative console with administrative security disabled. Credit to Edward Schaller for disclosing this problem to IBM.

For V6.1.0.11 through 6.1.0.21:

  • Apply Interim Fix APAR PK81387
  • –OR–
  • Apply Fix Pack 23 or later (6.1.0.23 targeted to be available late March 2009).
rispost

Mitsubishi Lancer Sport Sedan – Wallpapers

March 17th, 2009

Some wallpapers of the new 2008/09 version of the Mitsubishi Lancer Sport Sedan.

*know that the placing of the thumbs is not that funky, working on it :-)

rispost

Blogs – Uploading files, specifying MIME type in WAS not longer needed

March 17th, 2009

Think this topic is a bit outdated but just giving it a go to spread the info.

Few months back posted this one, it’s about the errors you get when
specifying  alternate files to upload in a blog. For every file you would
like to upload in blogs you had to specify the MIME type in the WAS console.

Found out that this kind of configuration is not longer required in LC 2.0.1.
Also had this confirmed by the guys of IBM.

rispost

UPDATED – Notification option in Activities

March 17th, 2009

In Activities you have the option to send notifications to members
of an Activity. At my company we were a bit confused by the behavior
of the sending of these notification mails.

We had an activity with five members, when sending notification mails
to all the members of this activity the mailing was split in two.

One mail for three members and one for the other two.

The thing that then occurred with the members of that activity was that
they didn’t saw everybody in the “To:” field and started mailing everybody
who was not in the “To:” field.

Raised an PMR at IBM for this one and got a very logical answer for it :-) .

In the QA_MEMBERPROFILE table of the OPNACT database for Activities you will
find a column Locale, this one holds the locale you last used in your browser
to visit the Activities page.

When a notification mail is sent to you it will be in the language set by that locale.

It explained for us why the mailing is split sometimes, some of our have
a Dutch browser, NL, and some use an EN version of their browser.

Not that it’s a solution for the “problem” we got, but eh we have a explanation for this :-D .

(more…)

Next Page »
   
© LOTUSCONNECTIONS.org , Designed by Stealth Settings
Entries (RSS) and Comments (RSS)